Logstash startup completed does not get dislayed

Elastic Stack Logstash
1

Hi everyone
I am using Window and trying to use Logstash 2.4.0. I am using the following config file

Conf Content
input {
file {
path => ["D:\ELK\logstash.log*.csv"]
start_position => "beginning"
}
}

filter {
csv {
columns => ["billing_entity","invoice"]
separator => ","
}

#grok {

match => { "call" => "%{WORD:billing_entity} %{WORD:invoice} %{WORD:company} %{WORD:username} %{WORD:reference} %{NUMBER:line_number} %{NUMBER:recipient_number} %{WORD:zone} %{WORD:network} %{DATE:date} %{TIME:time} %{WORD:country} %{WORD:duration} %{NUMBER:cost} %{WORD:currency} %{WORD:call_origin} %{WORD:billing_type}" }

#}
}

output {
csv {
fields => ["billing_entity","invoice"]
path => "D:\ELK\logstash.log\output\1.csv"
}
}

Source CSV Content
billing_entity,invoice
a,b
1,2
1,2
a,b

Execute Screen

Pasted image1445×350 21.3 KB

I am stuck after this. Logstash startup complete message doesn't get displayed or file. Kindly help me.

2

Logstash startup complete message doesn't get displayed or file.

What do you mean? You're getting the "Pipeline main started" message so Logstash does start up.

Is Logstash not reading the file? Please consult previous questions about this problem as it's extremely common for people to not get this right. Here are some keywords and hints:

  • If the file is older than 24 hours you need to adjust the file input's ignore_older option.
  • If Logstash thinks it already has processed the file you need to delete the sincedb file or set sincedb_path to "nul" (Windows) or "/dev/null" (not Windows).
  • Logstash might not have access to the file.
  • There might be a typo in the filename pattern.

Please do not post screenshots. Use copy/paste.

3

Thank your reminder and information to help.
The cause of the problem is the data file encode should be UTF-8.